Smart Protection

Various customization degrees are possible when integrating Malwarelytics into an app. For full control over its behavior, raw APIs — observers and method calls — can be used. An entirely different approach is a hassle-free SDK integration using the built-in Smart Protection system.

Smart Protection is a set of behavior patterns that are enabled by default. These patterns include a periodic evaluation of apps installed on the device, suggestion updates, initial scans, and an automatic evaluation of app changes.

There are two basic modes of operation:

1. Silent mode — default option. It does not show any UI but simply keeps the data up to date with the remote console.

2. Non-silent mode — facilitates automatic mitigation of detected threats. The available options are:

   • Display an app screen with a list of dangerous apps.
   • Display a notification about a dangerous app.

Configuration

Smart Protection can be configured to some extent using the SmartProtectionConfig settings in the AntivirusConfig.Builder.

val smartProtectionConfig = AntivirusConfig.SmartProtectionConfig.Builder()
                        .smartProtectionEnabled(true)
                        .silentModeEnabled(true)
                        .smartProtectionIntervalHours(72)
                        .performInitialFirstUpdate(true)
                        .build()

val antivirusConfig = AntivirusConfig.Builder()
    // other Anti-Malware feature configuration
    .smartProtectionConfig(smartProtectionConfig)
    .build()

Information about Updates and Troubleshooting

Smart Protection performs automatic updates that are hidden from the integrating app. In some cases, the app wants to react to freshly updated data, get some update information, or the app developers need to investigate a problem.

For this reason, the SDK offers:

1. Update observer.
2. Info data about the last successful and unsuccessful updates.

Registering an Update Observer

The application can register UpdateObserver to get notified about performed updates. The observer callback provides info data about the finished update. The observer configuration:

val updateObserver = object : UpdateObserver {
   override fun onSuggestionUpdated(observedUpdateInfo: ObservedUpdateInfo) {
       // handle observedUpdateInfo
   }
}

The observer can be registered in UpdateManager which is accessible via the Antivirus class.

val updateManager = AppProtection.getInstance().getAntivirus().getUpdateManager()
updateManager.registerUpdateObserver(updateObserver)

When it is no longer needed, the observer can be unregistered again.

updateManager.unregisterUpdateObserver(updateObserver)

The ObservedUpdateInfo data class has the following properties:

The performed updates can have one of these results:

The performed updates can be of these types:

Information about Past Updates

The SDK stores some information about past updates. This information can be obtained by calling:

val antivirus = AppProtection.getInstance().getAntivirus
val updateInfo = antivirus.getUpdateManager.getLastUpdateInfo()

The UpdateInfo data class has the following properties:

Updates with the result UpdateResult.PARTIAL_SUCCESS are counted as failed updates here.

The UpdateInfoSuccess data class contains the following properties:

The UpdateInfoFailure data class contains the following properties:

Troubleshooting with Manual Updates

Malwarelytics for Android provides API for performing manual updates. However, this API is not recommended to be used in production. It’s recommended to use the self-updating behavior of Smart Protection instead.

Manual updates should be used only in development to troubleshoot proper configuration or data inconsistencies.

A manual update can be done either full or partial. A full manual update can be performed by calling the updateSuggestions() method:

// run on a worker thread only
val updateResult = antivirus.getUpdateManager.updateSuggestions()

A partial manual update can be done by calling the updateSuggestionsForApps(Collection<String>) method with a collection of app package names (application IDs):

// run on a worker thread only
val appsToUpdate = listOf("com.example.app", "com.example.anotherapp")
val updateResult = antivirus.getUpdateManager.updateSuggestionsForApps(appsToUpdate)

The update result indicates whether the update was successful. The possible result values are: